protocol

status → green

branch → master

commit → e270ec5ce800fb37e75192c5628adec37be2c6cf

version → workspace crates 0.0.1

dirty → false

ci → green (exact-head CI run 29380436925)

build → pass (strict Rust, seven-crate publication dry-run, and CLI build in exact-head CI)

test → pass (Rust and TypeScript suites plus live SpiceDB, Keto, OIDC, and Jaeger integration)

typecheck → pass (canonical contract and strict compiler gates)

coverage → Rust 75.07% remote / 69.72% floor; TypeScript CLI 47.65% remote / 21.51% floor

release → publication dry-run passed; credential-gated release not executed

deploy → not applicable (contract crates and CLI)

endpoint → unavailable at PRIVATE_BETA_PRIVATE_ENDPOINT_REDACTED service intentionally not started during read-only assessment

observedAt → 2026-07-16

evidenceMode → automated

No gaps are open. Status corrects from red to green based on exact-head CI and the absence of unresolved ledger work.

sdk

status → green

branch → master

commit → 388be58f02a893279efa2cc76683fde304876b67

version → TypeScript 0.5.0; Rust 0.1.0; Go and Python contract peers

dirty → false

ci → green (exact-head protected CI run 29384450009)

build → pass (four-language packages and framework adapter matrix)

test → pass (TypeScript, Rust, Go, and Python suites)

typecheck → pass (Protocol mirror and manifest conformance)

coverage → TypeScript 76.07%; Rust 76.06%; Go 71.51%; Python 83.81%; all upward-only ratchets pass

release → TypeScript published to GitHub Packages; Rust, Go, and Python remain workflow-ready and credential gated

deploy → not applicable (polyglot library family)

endpoint → not applicable (library family)

observedAt → 2026-07-16

evidenceMode → automated

No gaps are open; maintain cross-language contract parity and upward-only coverage.

cloud

status → amber

branch → master

commit → b439265198a90b885db1b12525e99ebf9e3502e2

version → @frauthy/cloud-ui 1.1.0-next.0 source; 1.0.0-next.0 published and Brand-admitted

dirty → false

ci → green (exact-head CI run 29503510902)

build → pass (portal/backend build, credential-free linux/amd64 image, live image health, and Cloudflare staging/production dry-runs)

test → pass locally (268 pass, 35 environment-gated skips, 0 fail)

typecheck → pass locally

coverage → 63.28% remote measurement; 61.28% upward-only floor; 70% target

release → cloud-ui source is ahead of the published and Brand-admitted artifact; no package publication performed

deploy → Cloudflare Worker and Container contract remains dispatch-deployable; no deployment performed

endpoint → unavailable at PRIVATE_BETA_PRIVATE_ENDPOINT_REDACTED service intentionally not started during read-only assessment

observedAt → 2026-07-16

evidenceMode → automated

Closed: CLOUD-11

The control-plane portal now uses same-origin services, traces, metrics, alerts, projects, keys, billing, and audit APIs while fixture states remain explicit.

GitHub Packages authentication stays on the CI runner; Docker receives the tested portal plus the public backend dependency graph and no registry credential.

market

status → amber

branch → master

commit → b3e7fbd8461162e9b49c3f8e4bfbdeac51b50c81

version → @frauthy/market-ui 1.1.0-next.0 source; 1.0.0-next.0 published and Brand-admitted

dirty → false

ci → green (exact-head CI run 29500116144)

build → pass (backend, UI SDK, web, credential-free executable, and production image)

test → pass (backend, package, browser, axe, and live container health gates)

typecheck → pass (exact-head CI)

coverage → 63.19% remote measurement; 61.19% upward-only floor; 80% target

release → market-ui source is ahead of published and Brand-admitted artifact; immutable GHCR workflow is manual and was not dispatched

deploy → runtime rollout remains exclusively owned by Infrastructure Terraform; no deployment performed

endpoint → unavailable at PRIVATE_BETA_PRIVATE_ENDPOINT_REDACTED service intentionally not started during read-only assessment

observedAt → 2026-07-16

evidenceMode → automated

Closed: MKT-9

The trust registry reads the live marketplace API; synthetic catalog data is isolated and labeled as fixture evidence.

admin

status → red

branch → master

commit → dbdbe32550d84dbf8f7949e92b0e22d03021b3bd

version → @frauthy/admin-ui 1.1.0-next.0 source; 1.0.0-next.0 published and Brand-admitted

dirty → false

ci → green (exact-head CI run 29502409238)

build → pass (client library, web, and UI SDK catalog/build/pack/consumer gates)

test → pass (backend and UI suites, Playwright, axe, themes, fail-closed states, and visual baselines)

typecheck → pass (exact-head CI)

coverage → 55.99% measured; 53.99% upward-only floor; 70% target

release → admin-ui source is ahead of the published and Brand-admitted artifact; no package publication performed

deploy → none

endpoint → unavailable at PRIVATE_BETA_PRIVATE_ENDPOINT_REDACTED service intentionally not started during read-only assessment

observedAt → 2026-07-16

evidenceMode → automated

Closed: ADM-7, ADM-9

ADM-1 remains open for OIDC, sessions, and RBAC; ADM-5 remains open for runtime backend selection.

ADM-3 remains open because accessible editor and LSP-oriented scaffolding do not yet constitute the complete Monaco/LSP client bridge required by the gap.

site

status → amber

branch → master

commit → 995a7d95c45c4a310cd9553b50734ea99e828706

version → @frauthy/site-ui 1.1.0-next.0 source; 1.0.0-next.0 published and Brand-admitted

dirty → false

ci → green (exact-head CI run 29500115531)

build → pass (Astro production build, sitemap output, and UI SDK package gates)

test → pass (docs-link assertions, UI SDK tests, Playwright, and axe)

typecheck → pass (exact-head CI)

coverage → browser and accessibility gates exist, but no LCOV producer or Lighthouse budget; SITE-1 remains open

release → site-ui source is ahead of the published and Brand-admitted artifact; no package publication performed

deploy → manual-only Pages contract; no deployment performed

endpoint → unavailable at PRIVATE_BETA_PRIVATE_ENDPOINT_REDACTED service intentionally not started during read-only assessment

observedAt → 2026-07-16

evidenceMode → automated

Closed: SITE-3, SITE-4

Getting Started links directly to detailed UI and SDK documentation, and the reference accurately covers TypeScript, Rust, Go, and Python.

SITE-1, SITE-2, SITE-5, SITE-6, SITE-7, SITE-8, and SITE-9 remain open.

infrastructure

status → amber

branch → master

commit → b55481a453c7d7f5cfcd50a033dfb9b5c7da55f6

version → Terraform platform contract

dirty → false

ci → green (exact-head CI run 29450807947)

build → pass (three-environment Terraform plan smoke and Compose validation)

test → pass (Terraform validation, tflint, and lifecycle contract gates)

typecheck → not applicable; Terraform validate and tflint pass

coverage → not applicable; quality is enforced by validation, tests, plans, and lint

release → infrastructure modules are source controlled; no artifact publication performed

deploy → Cloudflare runtime, R2, and Neon PostgreSQL remain Terraform-owned; no apply performed

endpoint → unavailable at PRIVATE_BETA_PRIVATE_ENDPOINT_REDACTED shared stack intentionally not started

observedAt → 2026-07-16

evidenceMode → automated

No ledger gaps are open. Amber reflects credential/account and live-apply gates, not a source failure.

devops

status → amber

branch → master

commit → 8a71614d9c59ff145079dfd30cd06b5f2083af7f

version → @frauthy/devops-ui 1.1.0-next.0 source; 1.0.0-next.0 published and Brand-admitted

dirty → false

ci → green (exact-head CI run 29501035912 and E2E run 29501035841)

build → pass (portal and UI SDK catalog/build/pack/consumer gates)

test → pass (runtime adapters, proxy behavior, browser, axe, fail-closed states, and visual baselines)

typecheck → pass (exact-head CI)

coverage → reusable callers are adopted; aggregate enforcement remains blocked on Site LCOV and verified orchestration evidence

release → devops-ui source is ahead of the published and Brand-admitted artifact; no package publication performed

deploy → none

endpoint → unavailable at PRIVATE_BETA_PRIVATE_ENDPOINT_REDACTED service intentionally not started during read-only assessment

observedAt → 2026-07-16

evidenceMode → automated

Closed: DEVOPS-2

The evidence control room now consumes runtime evidence through adapters and a same-origin proxy, with explicit unavailable and fixture states.

DEVOPS-5 remains open pending a dedicated least-privilege FRAUTHY_CI_TOKEN; DEVOPS-7 remains open pending Site coverage and aggregate enforcement evidence.

sandbox

status → green

branch → master

commit → 4fb332561d52c002b2750d2902e8e17f5175981a

version → @frauthy/sandbox-ui 1.0.0-next.0 source, published, and Brand-admitted

dirty → false

ci → green (exact-head Integration run 29448176119)

build → pass (integration harness and aligned UI SDK)

test → pass (exact-head integration plus prior live 9/9 and 100/100 verification)

typecheck → pass (integration workflow)

coverage → live conformance evidence 9/9 and 100/100

release → sandbox-ui is aligned across source, GitHub Packages, and Brand admission

deploy → not applicable (integration suite)

endpoint → unavailable at PRIVATE_BETA_PRIVATE_ENDPOINT_REDACTED service intentionally not started during read-only assessment

observedAt → 2026-07-16

evidenceMode → automated

No gaps are open. Status corrects from red to green.

brand

status → amber

branch → master

commit → 5a586be163a0785f0f3fbc4dc282078eee31260d

version → Brand package family and portal 1.0.0-next.1

dirty → false

ci → unknown for exact assessed head; older CI receipts are not promoted to current evidence

build → source and catalog lock inspected directly; exact-head hosted build unknown

test → package-registry and immutable catalog-admission state inspected; manual assistive-technology review remains open

typecheck → unknown for exact assessed head

coverage → Brand Solid package has coverage; broader portal, web-component, and Lighthouse gaps remain open

release → Brand packages are 1.0.0-next.1; six product source catalogs at 1.1.0-next.0 remain unpublished and unadmitted

deploy → portal local-only; no deployment performed

endpoint → unavailable at PRIVATE_BETA_PRIVATE_ENDPOINT_REDACTED service intentionally not started during read-only assessment

observedAt → 2026-07-16

evidenceMode → inferred

BRAND-1 through BRAND-9 remain open. Stable promotion remains blocked on named manual VoiceOver/NVDA evidence.

The active Brand checkout is a user-owned cherry-pick with five staged Reading files; the assessment did not modify it.

root

status → amber

branch → master

commit → 37e70238d2c6248814b9a075a86b7d3fd6b73f35

version → workspace CLI contract

dirty → false

ci → green (exact-head Root CI run 29500114961)

build → pass (Bun CLI build and generated runner contracts)

test → pass (dependency preflight, lifecycle dry-runs, port registry, doctor JSON, spec contract, and stale-count gates)

typecheck → pass (Root CI)

coverage → not applicable

release → source-controlled workspace CLI; no artifact publication performed

deploy → not applicable

endpoint → not applicable (workspace CLI)

observedAt → 2026-07-16

evidenceMode → automated

ROOT-1, ROOT-8, ROOT-12, and ROOT-13 remain open for the live TUI, portal-path decision, and Cuitty documentation/initiative.

Infrastructure remains opt-in in the development selector and stack lifecycle commands were not invoked during assessment.

research

status → green

branch → master

commit → a460bb85befbe1c039afa116bb6f0a03d4cfa0ae

version → @frauthy/research-ui 1.1.0-next.0 source; 1.0.0-next.0 published and Brand-admitted; ledger v29 before ingestion

dirty → false

ci → green (exact-head pre-ingestion CI run 29501038661)

build → pass (Astro, package, and catalog gates at the assessed pre-v30 head)

test → pass (unit, browser, axe, visual, and ingestion gates at the assessed pre-v30 head)

typecheck → pass (exact-head pre-ingestion CI)

coverage → versioned ingestion, package verification, browser/axe, and visual evidence; no synthetic aggregate percentage claimed

release → research-ui source is ahead of the published and Brand-admitted artifact; no package publication performed

deploy → local dev and preview only; no deployment performed

endpoint → unavailable at PRIVATE_BETA_PRIVATE_ENDPOINT_REDACTED service intentionally not started during read-only assessment

observedAt → 2026-07-16

evidenceMode → automated

This v30 receipt adds exact branch, commit, dirty state, build, test, typecheck, release, endpoint, freshness, and evidence-mode fields while archiving v29 unchanged.

Full human-readable evidence and residual owners are recorded in reports/2026-07-16-portal-quality-program-assessment.md and governed by Root specs 09 through 15.